Erlang/OTP 17.0 < 25.3.2.20 / 26.2 < 26.2.5.11 / 27.0 < 27.3.3 RCE (CVE-2025-32433)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(240117);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/27");

  script_cve_id("CVE-2025-32433");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/06/30");

  script_name(english:"Erlang/OTP 17.0 < 25.3.2.20 / 26.2 < 26.2.5.11 / 27.0 < 27.3.3 RCE (CVE-2025-32433)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Erlang/OTP installed on the remote host is 17.0 prior to 25.3.2.20, 26.2 prior to 26.2.5.11, or 27.0
prior to 27.3.3. It is, therefore, affected by a remote code execution vulnerability where a serious vulnerability has 
been identified in the Erlang/OTP SSH server that may allow an attacker to perform unauthenticated remote code 
execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized 
access to affected systems and execute arbitrary commands without valid credentials.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Erlang/OTP version 25.3.2.20, 26.2.5.11, or 27.3.3 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-32433");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Erlang OTP Pre-Auth RCE Scanner and Exploit');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/04/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/04/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/17");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:erlang:erlang%2fotp");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ericcson_erlang_otp_win_installed.nbin", "ericsson_erlang_otp_nix_installed.nbin", "erlang_otp_ssh_detect.nbin");
  script_require_keys("installed_sw/Erlang-OTP", "installed_sw/Erlang-OTP SSH Application");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Erlang-OTP', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version':'17.0','fixed_version':'25.3.2.20'},
        {'min_version':'26.2','fixed_version':'26.2.5.11'},
        {'min_version':'27.0','fixed_version':'27.3.3'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);